oriolrius/pki-manager-web v3.12.4

v3.12.4 — eMudhra distrust + PKCS#12/JKS download fix

on GitHub

Security

• Stop trusting the compromised eMudhra intermediates (#9, https://emudhra.we-have-a-problem.com/)
  • Backend image: sets NODE_OPTIONS=--use-openssl-ca. Outbound TLS (KMS, OIDC discovery/JWKS) is now verified against Alpine's patched OS trust store (ca-certificates 20261020-r0) instead of the root store built into Node 22.23.3. This gives the same protection as Node 22.23.4, which has no published Alpine image yet. Future root distrusts take effect on the next image rebuild.
  • k8s issuer image: built with Go 1.26.10 (includes the crypto/x509 fix). It now ships the patched Debian trixie CA bundle in place of the stale distroless bundle (20250419~deb12u1), which still trusted emSign ECC Root CA - G3 and AAA Certificate Services.
  • krl-client: release binaries are built with Go 1.26.10, so they reject the chains even on SSH hosts whose OS trust store hasn't been updated.

Fixes

• Certificate downloads in PKCS#12 / PFX / JKS and password-protected key formats failed with spawn openssl ENOENT (#8). The backend runtime image now includes the openssl CLI used to build these bundles for both RSA and ECDSA keys.

No database migrations.